CVE-2026-18560: Improper order of authorisations in Mattermost GetFile API leads to an authenticated user to determine a post’s quarantined status
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate user’s permissions before other validations which allows non-content reviewers to infer a post’s flagged status via direct API call.. Mattermost Advisory ID: MMSA-2026-00754
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 11.11.0Patch MMSA-2026-00754
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Mattermost user who is not a content reviewer can exploit it. The issue is reachable through a direct GetFile API call over the network.
What information can be exposed?
The attacker can infer whether a post has been flagged or quarantined. The provided data does not indicate exposure of the post content itself or any integrity or availability impact.
Which versions are affected?
Affected releases are Mattermost 11.10.x through 11.10.0, 11.7.x through 11.7.9, 11.9.x through 11.9.1, and 11.8.x through 11.8.5.